For good measure, this adds \Q so it works if you happen to include ^, ] or -.

my @filename_filter = ('*','|','<','>','?','/');
my $filename_filter = join '', @file_filter;
$id =~ s/[\Q$filename_filter\E]//g;
[download]

That said, it's much much safer to specify which characters are safe to include rather than then specifying which characters are not safe to include.